News for hackers. Stuff that matters.
Re:Poste.io – Complete Mail Server by foxylad on Wednesday February 22, 2023 @09:51PM (#34906110)
THIS.

Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery.

Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% encryption. But Gmail still rate-limits us daily, so their customers get their booking confirmations several hours late.

It's getting to the point where running an independent mail server is impossible. Yet another part of the open internet bites the dust.

Re:Poste.io – Complete Mail Server by brightball on Wednesday February 22, 2023 @10:55PM (#34906568)
How many servers do you have? Just curious if the rate limit is per IP address?
Re:Poste.io – Complete Mail Server by TedDoesntTalk on Wednesday February 22, 2023 @11:34PM (#34906805)
We have a Microsoft email subscription (all our mail is hosted with them), and their smtp server rate limits how much mail we send to our customers. We can’t even send 30 emails at once. We had to implement retry logic with back off.
Re:Poste.io – Complete Mail Server by exclusiv on Thursday February 23, 2023 @01:28AM (#34907459)
Why not just use Sendgrid or similar for SMTP emails to customers, get a dedicated IP with them and have way less concern.

I always prefer to isolate those things from the main corporate email and reputation anyway.

You don't want your main domain getting hacked and affecting customer emails or vice versa.

Re:Poste.io – Complete Mail Server by ryanjshaw on Thursday February 23, 2023 @02:36AM (#34907893)
Have you spoken to an account manager there? I send way more than that on a regular basis. I do it sequentially for simplicity, I wonder if that makes a difference.
Re:Poste.io – Complete Mail Server by KyeRussell on Thursday February 23, 2023 @04:21AM (#34908534)
You should be using a dedicated transactional email provider, and accept the additional cost. At most scales, this is the correct business decision.
Re:Poste.io – Complete Mail Server by hanniabu on Wednesday February 22, 2023 @11:58PM (#34906957)
Really hoping ENS can step in here and fill this gap. There's a lot of work being done on social and messaging infrastructure. Using that as an email and chat handle and social handle would be huge for maintaining open messaging. Unfortunately this relies on adoption and people living past their bias and admitting there's use cases.
Re:Poste.io – Complete Mail Server by n3storm on Thursday February 23, 2023 @01:11AM (#34907356)
What is ENS?
Re:Poste.io – Complete Mail Server by kristianp on Thursday February 23, 2023 @01:13AM (#34907370)
Re:Poste.io – Complete Mail Server by kristianp on Thursday February 23, 2023 @04:56AM (#34908700)
Whoops, Ethereum Naming Service
Re:Poste.io – Complete Mail Server by kkielhofner on Thursday February 23, 2023 @02:03AM (#34907671)
I’ve been in the Ethereum ecosystem for over six years.

I’ve heard “there’s a lot of work being done on…” literally thousands of times. Yet outside of the crypto-sphere I’ve only met a handful of people who’s life would be impacted in the slightest if the entire thing disappeared.

Ethereum is eight years old and debates about use cases, etc aside I think even someone towards the middle of the debate can readily acknowledge progress, utility, value, and adoption has been incredibly slow.

Consider ENS - the last time I registered with ENS the process was just as confusing and convoluted as ever, only in this instance with gas fees I paid around $300 for the name. Oh, and the various transactions kept failing - leaving me wondering (per usual with crypto) if my funds went up in smoke, off to some scammer, etc.

Like so many times in crypto before I just assumed the funds were gone but like I said I DO follow this space and DO find it interesting so I consider burning crypto left and right a relatively cheap education/hobby. Plus I get to tell cool stories like this one on HN ;).

I can’t imagine how creaky, bug ridden, impossible to scale, nearly impossible for mortals to use, and inevitably completely overrun by scammers and frauds an Ethereum (or any crypto) based mail and messaging system would be. No. Just no.

With every day, week, month, and year that passes hearing “We’re building! People are working on XYZ!” when meanwhile the only thing people actually see is the latest headline for some crypto criminal, fraud, scam, collapse of last years “use case” (NFTs anyone?), etc.

I’m not saying it’s dead but I think it’s pretty safe to say the window for anything approaching mass adoption, credibility, and real utility has closed.

“Stop trying to make fetch happen! It’s not going to happen!”

Re:Poste.io – Complete Mail Server by hanniabu on Thursday February 23, 2023 @02:13AM (#34907741)
You must only be following at a pretty surface level if you think "things are being worked on" is just a meme
Re:Poste.io – Complete Mail Server by carlhjerpe on Thursday February 23, 2023 @03:50AM (#34908357)
Things are being worked on but nothing changes, crypto is still just a speculative asset for people to try making big bucks quickly with, people use monero to buy drugs. Those are the two usecases, it doesn't matter how much people work on cool crypto things if the usecase stays the same.
Re:Poste.io – Complete Mail Server by louison11 on Thursday February 23, 2023 @02:58AM (#34908041)
100% agree. Been in crypto for 12 years. I’ve held this view for the last 7 years. So much delusion in the space. So much “technological orgasms” with no grounding in real world business dynamics and economics.
Re:Poste.io – Complete Mail Server by kkielhofner on Thursday February 23, 2023 @09:48AM (#34911248)
Precisely. I follow because there is some interesting technical work being done. There is a lot being built but even after tons of time, effort, and resources (at least 10s of billions of dollars) the only thing that ever comes out of this work is another incredibly dense and nearly impossible to use "technological orgasm" with an extremely thin use case utilized only by (seemingly) the team that built it and a minuscule circle of hardcore enthusiasts.

MetaMask is by far the most popular wallet used for all things Ethereum and Web3. They touted "30 million" MAUs[0] during the peak (3/22) of the last crypto craze/bubble. Let's put that in perspective - there are an estimated 5.3 billion people on the internet. 30 million MAUs represents 0.06% of worldwide internet users. Facebook (which has been in rapid decline) has at least 2.6 billion MAUs. One social media platform vs an entire ecosystem (MetaMask can easily be characterized as the official onramp to Web3). Literally a half of a half of one percent of the TAM (internet users).

Want a (somehow) even bleaker picture? According to DappRadar the top 10 most popular Dapps[0] COMBINED have a lifetime total of 888k wallets (all numbers rounded up) that have ever interacted with the Dapp in any capacity. That's 0.00167% of worldwide internet users and I'm sure the MAUs for these Dapps are even more pathetic. Additionally, it's widely known that wallet != user (many users use multiple wallets and addresses). Looking at these Dapps none of them have any utility other than "DeFi" (swapping tokens around), play to earn games, and straight up gambling. To look at it another way, an absolute best case (impossible) scenario for MAUs of these apps worldwide is roughly the equivalent of the entire population of a small US city. Have you heard of Lee's Summit, Missouri (to pick one)? Yeah me neither and the same could be said for these Dapps.

All of the building in the crypto ecosystem is by crypto zealots for crypto zealots which the MetaMask and Dapp numbers show is an absurdly tiny (so small you can barely wrap your head around it) population. Crypto (other than gambling on exchanges) is an extremely obscure fringe religion.

[0] - https://decrypt.co/95039/metamask-consensys-30-million-users

[1] - https://dappradar.com/rankings

Re:Poste.io – Complete Mail Server by wyclif on Thursday February 23, 2023 @01:28AM (#34907463)
I'm a former sysadmin and as such can remember the days when it was almost considered fun (at least by nerds) to run your own mail server.

Those days are long gone, and the reason why is that monopolistic companies hate open protocols like email and want to 'monetize' everything they can.

Re:Poste.io – Complete Mail Server by franga2000 on Thursday February 23, 2023 @03:15AM (#34908132)
How is spam related to SPF and DKIM? Those prevent forgery, but if a spammer actually owns a domain, they can send you whatever they want. That's where the majority of spam comes from, so it's far from a solved problem.
Re:Poste.io – Complete Mail Server by Avamander on Thursday February 23, 2023 @08:48AM (#34910507)
A lot of spammers forge, requiring SPF/DKIM does help a bit. But yeah, not a solution.
Re:Poste.io – Complete Mail Server by kevincox on Friday February 24, 2023 @07:38AM (#34923862)
SPF and DKIM allow using domain reputation instead of IP reputation. Especially with IPv6 IPs are fairly easy to aquire and can be "stolen" either by spoofing/highjacking the network or more easily by compromising some hosts and sending from there. Hijacking a domain is generally harder as you need to compromise a mail server to get both the IP and DKIM key. And there are less mail servers than WordPress instances to hijack.

Sure, you can buy domains but that leaves some paper trail and generally you will see added spam scores for new domains.

So SPF and DKIM don't improve spam scores on their own, but the give a much more reliable path to building reputation.

Re:Poste.io – Complete Mail Server by mittermayr on Thursday February 23, 2023 @04:05AM (#34908443)
Spam is only solved by the large mail providers (who have enough data to act on it within a split second).

After the great Gmail exodus two years ago (when they killed then unkilled legacy domain accounts), I moved to MXRoute — and the amount of unfiltered spam I get is insane. It's a daily nuisance. I have added about 200 filter words now, blocked hundreds of e-mail addresses, but it's next to impossible to filter out sometimes.

From conversations and threads online by the MX Route admin, it seems like this is a nearly unsolvable problem, still. Spam evolves so fast and uses throwaway one-time approaches only, so once you've filtered for a pattern, the next campaign looks completely different.

So, yeah, sorry about the long response, but I don't think Spam has been solved, at all, at least not if you're using an e-mail that's been around for longer than a few years (and appeared at least in one leak).

Re:Poste.io – Complete Mail Server by fesc on Thursday February 23, 2023 @06:47AM (#34909300)
I am using a small German email provider and I can't remember the last time I got spam.

What's even crazier is that they are so confident in their spam filter that they simply reject mails classified as spam. But that hasn't been a problem since the few years I have been using them as well.

Re:Poste.io – Complete Mail Server by account42 on Friday February 24, 2023 @06:48AM (#34923552)
I have a wildcard email on my domain. In fact multiple domains. Multiple of these have emails listed in bug trackers, git repos and in plaintext on my website.

The only filter I have is a couple of regular expressions to block the most lazy of spam at submission time. Even without that I got less than 50 spam mails a day, usually quite a bit less - and almost all of those are automatically sorted into my spam folder. How long does it take you to glance over a low two digit number of emails each day? Not a lot for me.

I think the "spam" problem is overrated. Do you get more spam than me or do you just have different expectations?

Re:Poste.io – Complete Mail Server by KyeRussell on Thursday February 23, 2023 @04:18AM (#34908512)
Impersonation is “””solved””” by SPF and DKIM, not spam.
Re:Poste.io – Complete Mail Server by fuzzy2 on Thursday February 23, 2023 @04:54AM (#34908685)
Most spam I receive (and that continues to somehow bypass my spam filters) originates from Gmail. So no, spam is not solved, not at all.

Spam is only “solved” on big providers because they mostly accept mails only from other big providers.

---

I would argue that “running an independent mail server” and mass-mailing are two entirely separate concerns.

Re:Poste.io – Complete Mail Server by GTP on Thursday February 23, 2023 @07:06AM (#34909406)
> Most spam I receive [...] originates from Gmail

> Spam is only “solved” on big providers because they mostly accept mails only from other big providers.

I would say that only accepting emails form other big providers isn't a good solution then.

Re:Poste.io – Complete Mail Server by adr1an on Friday February 24, 2023 @04:28AM (#34922703)
Of course I can't prove this and is just from my subjectiviy and limited experience, yet...

I've reasons to believe that Gmail users get more spam emails as they report these.

It would be nice if such outsourcing went into other parts of the net (e.g. captcha).

Re:Poste.io – Complete Mail Server by nedt on Thursday February 23, 2023 @07:32AM (#34909607)
Not only are the blocking. They also send bounce spam although they know with SPF record, that the original mail was send by a server that's not allowed in that domain.
Re:Poste.io – Complete Mail Server by Avamander on Thursday February 23, 2023 @08:47AM (#34910498)
Spam is one of the most difficult content classification challenges for the past 20+ years.

There are approaches that work well, on a small scale, but "solved" is a step too far.